What data breach notification mailing actually includes.
Most mail vendors quote a price per piece and leave the rest of the scope undefined. This page defines it — line by line, including what we do not do — so you can compare us against a bid or a bundled administrator on the same terms.
What is in scope, what do we have to supply, and how is it priced?
In scope, every matter.
Nothing below is an upsell. Tier changes the speed, not the deliverables.
Secure intake
IncludedEncrypted portal or SFTP transfer of the recipient file and approved letter language, under a BAA where the data includes protected health information. Recipient data is never accepted by email.
Address hygiene
IncludedCASS processing with delivery-point validation, NCOALink move update, de-duplication, deceased suppression, foreign-address split-out, and a written exception report for your review before anything prints. See CASS and NCOA processing.
Composition
IncludedIn-house typesetting of counsel's approved language into a finished letter, including multiple versions per affected population and merge of per-record variables such as enrollment codes. See multi-population letters.
Proofs
IncludedComposed samples of every letter version for written approval. Production does not begin without it. Proofs are the control gate — one named approver, one written approval.
Print, insert, mail
IncludedProduction across two facilities with camera-verified inserting, then deposit with USPS in the class you elect: First-Class, Certified, or Certified with Electronic Return Receipt.
Evidence package
IncludedAffidavit of mailing, mailing manifest, USPS acceptance documentation, and the hygiene summary — delivered at mailing, not on request. See affidavit and proof of mailing.
Return mail
IncludedUndeliverable pieces received, scanned, and logged with reason codes over a 60–90 day window, with NCOA re-lookup and re-mail on your approval. See return-mail management.
What we do not do — on purpose.
A mailing vendor that claims the whole incident response is selling you a coordination layer. These belong elsewhere, and we will tell you where.
Legal advice or letter drafting
Counsel determines whether notification is required, to whom, by when, and in what words. We typeset and produce the language you approve. We do not opine on legal sufficiency.
Forensics and data mining
Determining which individuals were affected, and which data elements for each, happens upstream. We take the finalized list as an input.
Call centers and credit monitoring
We print the toll-free number and enrollment codes your call-center and monitoring vendors issue. We do not staff phones or provide monitoring products.
Regulator, media, and web notice
HHS portal submissions, state attorney general filings, media notice placement, and website posting stay with counsel and the affected organization. Our lane is the mail.
Email or electronic notification
Where an individual has agreed to electronic notice, that channel is handled by the client. We produce physical mail.
Deciding who gets suppressed
We flag duplicates, deceased records, and bad addresses in the exception report. Whether a record is dropped, corrected, or mailed anyway is your written call.
What we need from you.
| Input | Who supplies it | Needed by |
|---|---|---|
| Signed MSA and BAA | Firm or affected organization | Before intake — or same day on an emergency matter |
| Recipient file | You or your data-mining provider | Start of the production clock |
| Approved letter language | Counsel | With the file, for composition |
| Population map | Counsel | With the file, if more than one letter version |
| Mail class election | Counsel | Before proofs — it affects layout and cost |
| Letterhead and signature | Affected organization | Before proofs |
| Enrollment codes | Monitoring vendor | Before proofs, if the letter offers monitoring |
| Named proof approver | You | Before productionOne decision-maker. Committee approval is the most common cause of a missed mail date. |
File format
We accept delimited text (CSV or pipe), fixed-width, and Excel. One row per intended recipient, with name and address in discrete fields. We do not accept recipient lists as PDFs or as scanned images — converting those consumes hours you do not have late in a clock. The full field layout is published on the incident-response partner page.
How a matter is priced.
Every matter is quoted in writing before intake. There are four components, and postage is never marked up.
- Matter setup. A one-time fee covering intake provisioning, file analysis, composition setup, and proofing. This is why very small matters carry a minimum — a 400-record matter takes nearly the same setup as a 40,000-record one.
- Per-piece production. Print, insert, and mail preparation, priced by page count, color, envelope size, and insert count.
- Postage, at cost. Passed through at the actual USPS rate paid, documented in the invoice. Certified and return-receipt fees are itemized separately.
- Optional services. Certified Mail handling, additional language versions, extended return-mail windows, advanced address research, and expedited or emergency tier surcharges.
What drives the number up or down
- Tier. Emergency production runs against overtime and weekend labor. Standard is materially cheaper for the same deliverables.
- Version count. Two populations cost less than nine. Each version needs its own composition, proof, and QC pass.
- Mail class. Certified adds per-piece USPS fees plus handling; on large populations this dominates the quote. See Certified Mail for breach notifications.
- File condition. A clean, conforming file prices better than one that needs parsing, reconciliation, or a second submission.
- Page count. A two-page notice with a state-specific insert and a monitoring enrollment sheet is a different piece than a one-page letter.
We do not publish per-piece rates because they move with postage, paper, and matter specifics. We do quote in writing, itemized, before you commit — including on emergency matters.
Mail-only vendor or full-service administrator?
Both are legitimate choices. The question is whether you need the bundle.
| Consideration | NotifyCertain (mail-only) | Full-service administrator |
|---|---|---|
| Best fit | Counsel already has forensics, review, and monitoring vendors in place | No vendors selected; client wants one throat to choke |
| Matter size | 500 to 250,000+ records, including matters too small to interest a large administrator | Very large or highly complex multi-jurisdiction programs |
| Speed to mail | Direct — no coordination layer between counsel and the press | Depends on internal handoffs across bundled services |
| Cost profile | Pay for production and postage only | Program management priced across the bundle |
| Who touches data | One operator, in-house, no subcontractors on recipient data | Often several subcontractors, each a vendor-risk question |
| Call center & monitoring | Not provided — you keep your own vendors | Bundled |
Scoping questions we get weekly
Can you handle a matter of only a few hundred records?
Yes. Small matters are governed by a matter minimum because setup effort barely scales down, but we take them — and they are frequently the matters large administrators decline or slow-walk.
What is the largest matter you can mail in one window?
We regularly produce matters into the mid six figures. The binding constraint is never total capacity; it is the mail date you need. Give us the count and the deadline and we will confirm in writing what is achievable on which tier.
Do you need to know what data was breached?
Only to the extent it drives letter versions. We need to know that population A gets version 1 and population B gets version 2 — not the underlying data elements for any individual. Send the population code, not the exposure detail.
Can the letter come from the client's letterhead rather than yours?
Always. Notices mail under the affected organization's letterhead and signature. NotifyCertain does not appear on the recipient-facing piece unless you ask for it.
What if the record count changes after we start?
Expected — lists move as review completes. Additions before proof approval are absorbed. Additions after production is underway are handled as a supplemental mailing with its own manifest and affidavit, which is cleaner evidentially than restating the first one.
Do you sign a BAA for non-healthcare matters?
A BAA applies where protected health information is involved. For other matters, the confidentiality and data-handling terms of the MSA govern, and we can execute a separate data-processing addendum if your client requires one.